Security Incidents mailing list archives
Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com
From: Brian McWilliams <bmcw () attbi com>
Date: Wed, 08 May 2002 22:25:03 -0400
At 08:40 PM 5/6/2002, Edwards, David (JTS) wrote:
Hi, We've just found some instances of "netbuie.exe" running in some terminal server sessions here. The file was written to the Winnt\system32 directory about 6:00pm on Sunday and registry entries made in: HKLM/Software\Microsoft\windows\current version\run HKLM/Software\Microsoft\windows\run
As you suspected, appears that NetBUIE.exe is a scumware Trojan that has been posted up on the Web as a Microsoft Xbox emulator:
http://www.newsbytes.com/news/02/176472.html Brian ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service.For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com Edwards, David (JTS) (May 07)
- Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com Rainer Duffner (May 07)
- Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com H C (May 07)
- Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com Nick FitzGerald (May 07)
- Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com Brian McWilliams (May 09)
- <Possible follow-ups>
- RE: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com Edwards, David (JTS) (May 07)
- Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com Rainer Duffner (May 08)
- RE: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com Edwards, David (JTS) (May 08)